feat(1d): G3 — custom install-steps hook + graceful-generic (DG5) + DG3 N/A-skip demo

tests/custom-html-tiny/install_steps.sh seeds content into the volume pre-deploy. Proof: install
FAILS without the hook (404, graceful-generic), PASSES with it. Same run shows backup/restore=skip
(custom-html-tiny non-backup-capable) — DG3 N/A-skip. deploy-count=1. recipe_meta shortens timeouts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

machine-docs/STATUS-1d.md

@@ -18,8 +18,9 @@ per-recipe overlay authoring is Phase 2.
 - [~] **DG2** — Generic UPGRADE: previous/pinned → upgrade to target; reconverge + still serving.
       **Green on hedgedoc (3.0.9→3.0.10); CLAIMED (G1).**
 - [~] **DG3** — Generic BACKUP+RESTORE for backup-capable recipes; clean N/A (skip) otherwise.
-      **Backup-capable path green on hedgedoc (snapshot_id artifact + healthy restore); CLAIMED (G1).**
-      N/A-skip run-demo (non-capable serving recipe) lands in G3 with custom-html-tiny.
+      **Backup-capable path green on hedgedoc (snapshot_id artifact + healthy restore); CLAIMED (G1).
+      N/A-skip run-demo green: custom-html-tiny (non-backup-capable) → backup/restore = skip while
+      install passes (G3 Run B).**
 - [~] **DG4** — Layering (override-or-extend; generic is the default); discovery + cc-ci/repo-local
       precedence settled in DECISIONS. Invariant: no overlay for an op ⇒ generic runs.
       **CLAIMED (G2): custom-html overlays override+extend the generic, all 4 tiers green; discovery
@@ -27,7 +28,9 @@ per-recipe overlay authoring is Phase 2.
 - [~] **DG4.1** — Overlays reuse the deployment: ONE deploy + ONE teardown per run; no extra
       new/deploy/undeploy (assert via deploy-count). **CLAIMED (G2): deploy-count=1 across the full
       overlay lifecycle.**
-- [ ] **DG5** — Custom install-steps hook + graceful-generic rule; fail-without / pass-with proof.
+- [~] **DG5** — Custom install-steps hook + graceful-generic rule; fail-without / pass-with proof.
+      **CLAIMED (G3): custom-html-tiny — install fails without the hook (404, graceful), passes with
+      tests/custom-html-tiny/install_steps.sh seeding content.**
 - [ ] **DG6** — `!testme` e2e on an unconfigured recipe through the real pipeline; per-op reporting.
 - [ ] **DG7** — Real, DRY, clean: no softened/skip/xfail assertions; generic in the shared harness;
       teardown always; respects MAX_TESTS.
@@ -41,9 +44,10 @@ per-recipe overlay authoring is Phase 2.
 - **G4** — `!testme` e2e + per-op reporting + docs + cold verify. *Accept: DG6, DG7, DG8 → DONE.*
 
 ## In flight
-**G3 — custom install-steps hook + graceful-generic (next).** Implement the install_steps.sh hook
-proof on custom-html-tiny (needs content to serve → fails generic install without the hook, passes
-with it), which ALSO yields DG3's N/A-skip run-demo (custom-html-tiny is non-backup-capable).
+**G4 — !testme e2e + per-op reporting + docs + migrate remaining recipes (next).** Wire the full
+generic suite through a real `!testme` PR on an unconfigured recipe (per-op reporting), migrate the
+remaining recipe overlays (keycloak/cryptpad/matrix-synapse/n8n/lasuite-docs) to the assertion-only
+deploy-once contract so nothing regresses (DG7), write docs (DG8), then request final cold-verify.
 
 **F1d-1 — FIXED, awaiting Adversary close.** F1d-2 — FIXED (deploy honors the pin; upgrade has a
 move-assertion so a no-op can't pass), awaiting Adversary re-test+close.
@@ -65,6 +69,14 @@ generic) + the "no overlay ⇒ generic" invariant proven by `tests/unit/test_dis
 Reproduce (cold): `RECIPE=custom-html STAGES=install,upgrade,backup,restore CCCI_JANITOR_MAX_AGE=0 \
 cc-ci-run runner/run_recipe_ci.py` (TIER lines show `cc-ci:` overlays) + `cc-ci-run -m pytest tests/unit`.
 
+**Gate: G3 (DG5) CLAIMED, awaiting Adversary** — custom install-steps hook on **custom-html-tiny**:
+WITHOUT `tests/custom-html-tiny/install_steps.sh` the generic install FAILS (404, graceful-generic —
+reported per-op, not a crash); WITH it (seeds index.html into the content volume pre-deploy) install
+PASSES. The same Run B also demonstrates DG3's N/A-skip: custom-html-tiny is non-backup-capable, so
+backup/restore report **skip** while install/upgrade pass (deploy-count=1). Evidence in JOURNAL-1d.
+Reproduce (cold): run `RECIPE=custom-html-tiny STAGES=install …` with the hook absent (install:fail)
+then present (install:pass, backup/restore:skip).
+
 Design (DECISIONS.md Phase 1d): tier model with the lifecycle OP owned by the shared harness (test
 files = assertions only); override precedence repo-local > cc-ci > generic + extend-by-composition;
 deploy-once with a deploy-count guard; backup-capability auto-detect; install-steps shell hook.